CVE-2025-25141
Published: 07 February 2025
Summary
CVE-2025-25141 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a PHP Local File Inclusion flaw (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Fami Sales Popup WordPress plugin by zankover, impacting all versions through 2.0.0.
An unauthenticated remote attacker can exploit the issue over the network to include arbitrary local PHP files on the server. Successful exploitation can yield high impacts to confidentiality, integrity, and availability, although the CVSS 7.5 rating notes high attack complexity and required user interaction.
The Patchstack advisory at the referenced URL documents the Local File Inclusion vulnerability in the affected plugin versions and serves as the primary public source for further details on the issue.
EPSS probability rose from a low baseline to a peak of 0.0218, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4052
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup fami-sales-popup allows PHP Local File Inclusion.This issue affects Fami Sales Popup: from n/a through <= 2.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables T1190 (exploiting public-facing apps via crafted requests) and T1005 (arbitrary local file inclusion for data disclosure or execution of local PHP files).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the PHP Local File Inclusion vulnerability by requiring timely patching or updating of the affected Fami Sales Popup WordPress plugin to eliminate the flawed include/require statement.
Enforces validation of user-supplied inputs used in PHP include/require statements to block malicious filenames or paths that enable local file inclusion.
Restricts or prohibits installation of unapproved user-installed software like vulnerable WordPress plugins, preventing deployment of components susceptible to this LFI vulnerability.